CVE-2026-118489: Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the…

In Eclipse Vert.x versions 4.0.0,4.5.35 or 5.0.0,5.2.2, when one CachingWebClient is shared across users — the documented pattern of a per-user WebClientSession over a shared caching client — a response that is specific to one user but is cacheable and not marked private/no-store is stored in the...

CVE-2026-121433: AzuraCast: AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media…

AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/stationid/files/bulk so...

CVE-2026-63476: isomorphic-git: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloctargetSize. A malicious or...

CVE-2026-54161: networkupstools nut: Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS,…

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify, asyncnotify, and wall. Whe...

CVE-2026-63395: isomorphic-git: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later...

CVE-2026-64672: gruntwork-io terragrunt: Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink alread...

CVE-2026-95745: Hewlett Packard Enterprise (HPE) Fabric Composer: A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct…

A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to cause the management services to become unavailable...

CVE-2026-95748: Hewlett Packard Enterprise (HPE) Fabric Composer: A SQL injection vulnerability exists in HPE Networking Fabric Composer

A SQL injection vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to run arbitrary database commands...

CVE-2026-95732: Hewlett Packard Enterprise (HPE) Fabric Composer: An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer

An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system...

CVE-2026-95738: Hewlett Packard Enterprise (HPE) Fabric Composer: Authentication bypass vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an…

Authentication bypass vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow a...

CVE-2026-95739: Hewlett Packard Enterprise (HPE) Fabric Composer: An improper restriction of excessive authentication attempts vulnerability in the API of HPE Networking Fabric Composer…

An improper restriction of excessive authentication attempts vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct brute-force attacks against user accounts if certain preconditions outside of the attacker's control are met. Successfu...

CVE-2026-104608: GitHub Enterprise Server: A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld)

A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service babeld. babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with ...

CVE-2026-103077: myCred: Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control…

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2...

CVE-2026-108324: Tanium Tanium Client: Tanium addressed a denial of service vulnerability in Tanium Client.

Tanium addressed a denial of service vulnerability in Tanium Client...

CVE-2025-71452: Vembu Technologies BDRSuite: Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in…

Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are...

CVE-2026-108048: AM System ALO Suite: Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality

Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single account. As a result, a remote attacker can repeatedly call...

CVE-2026-108047: AM System ALO Suite: Inadequate authorization vulnerability in Alosuite’s user invitation functionality

Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepti...

CVE-2026-118237: GitHub Enterprise Server: An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld)

An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service babeld. When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access...

CVE-2026-120843: Barn2 Plugins Posts Table with Search & Sort: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Stored XSS.This issue affects Posts Table with Search & Sort: from n/a through 1.4.14...

CVE-2022-29966: Emerson Ovation: Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller…

Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition...